The fbComposite function in fbpict.c in the Render extension in the X server in X.Org X11R7.1 allows remote authenticated users to cause a denial of service (memory corruption and daemon crash) or possibly execute arbitrary code via a crafted request, related to an incorrect macro definition.

The X.Org X11 Server was updated to fix several bugs and 2 security issues :

Two security issues were fixed: CVE-2010-2240: This fix adds a workaround for overlapping stacks and heaps in case of OOM conditions.This workaround is necessary if the kernel is not properly adding guard or gap-pages below the stack. 

CVE-2010-1166: The fbComposite function in fbpict.c in the Render extension in the X server in X.Org X11R7.1 allows remote authenticated users to cause a denial of service (memory corruption and daemon crash) or possibly execute arbitrary code via a crafted request, related to an incorrect macro definition.

Non-Security Bugs fixed: Fix some shortcomings in the Xdmcp implementation. It used to suppress loopback addresses from the list of potential display addresses to report to xdm, even when talking to xdm through a loopback address. Now only display addresses of the same kind as the xdm connection are reported to xdm.

This most notably helps Xvnc servers contacting the local xdm, because they were severely affected by the suppression of loopback addresses.

The remote Oracle Linux 5 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2010-0382 advisory.

    [1.1.1-48.76.0.1.el5_5.1 ]
    - Added oracle-enterprise-detect.patch
    - Replaced 'Red Hat' in spec file

    [1.1.1-48.76.1]
    - xserver-1.1.1-mod-macro-parens.patch: Fix insufficient parentheses in       Render and arc computation code. (#495733)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An incorrect calculation flaw was discovered in the X.Org Render extension. A malicious, authorized client could exploit this issue to crash the X.Org server or, potentially, execute arbitrary code with root privileges. (CVE-2010-1166)

All running X.Org server instances must be restarted for this update to take effect.

The X.Org X11 Server was updated to fix several bugs and 2 security issues :

  - This fix adds a workaround for overlapping stacks and     heaps in case of OOM conditions.This workaround is     necessary if the kernel is not properly adding guard or     gap-pages below the stack. (CVE-2010-2240)

  - The fbComposite function in fbpict.c in the Render     extension in the X server in X.Org X11R7.1 allows remote     authenticated users to cause a denial of service (memory     corruption and daemon crash) or possibly execute     arbitrary code via a crafted request, related to an     incorrect macro definition. (CVE-2010-1166)

Non-Security Bugs fixed :

  - Fix some shortcomings in the Xdmcp implementation. It     used to suppress loopback addresses from the list of     potential display addresses to report to xdm, even when     talking to xdm through a loopback address. Now only     display addresses of the same kind as the xdm connection     are reported to xdm.

  - This most notably helps Xvnc servers contacting the     local xdm, because they were severely affected by the     suppression of

X clients could cause a memory corruption in the X Render extension which crashes the X server (CVE-2010-1166). This has been fixed.

The X.Org X11 Server was updated to fix 2 security issues :

  - This fix adds a workaround for overlapping stacks and     heaps in case of OOM conditions.This workaround is     necessary if the kernel is not properly adding guard or     gap-pages below the stack. (CVE-2010-2240)

  - The fbComposite function in fbpict.c in the Render     extension in the X server in X.Org X11R7.1 allows remote     authenticated users to cause a denial of service (memory     corruption and daemon crash) or possibly execute     arbitrary code via a crafted request, related to an     incorrect macro definition. (CVE-2010-1166)

This update fixes a memory corruption in the X Render extension in the X server.

CVE-2010-1166: The fbComposite function in fbpict.c in the Render extension in the X server in X.Org X11R7.1 allows remote authenticated users to cause a denial of service (memory corruption and daemon crash) or possibly execute arbitrary code via a crafted request, related to an incorrect macro definition.

Updated xorg-x11-server packages that fix one security issue are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

X.Org is an open source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical user interfaces are designed upon.

An incorrect calculation flaw was discovered in the X.Org Render extension. A malicious, authorized client could exploit this issue to crash the X.Org server or, potentially, execute arbitrary code with root privileges. (CVE-2010-1166)

Users of xorg-x11-server should upgrade to these updated packages, which contain a backported patch to resolve this issue. All running X.Org server instances must be restarted for this update to take effect.

Loic Minier discovered that xvfb-run did not correctly keep the X.org session cookie private. A local attacker could gain access to any local sessions started by xvfb-run. Ubuntu 9.10 was not affected.
(CVE-2009-1573)

It was discovered that the X.org server did not correctly handle certain calculations. A remote attacker could exploit this to crash the X.org session or possibly run arbitrary code with root privileges.
(CVE-2010-1166).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
75779	openSUSE Security Update : xorg-x11-Xvnc (openSUSE-SU-2010:0561-1)	Nessus	SuSE Local Security Checks	high
68035	Oracle Linux 5 : xorg-x11-server (ELSA-2010-0382)	Nessus	Oracle Linux Local Security Checks	critical
60786	Scientific Linux Security Update : xorg-x11-server on SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	high
51636	SuSE 11.1 Security Update : Xorg (SAT Patch Number 2968)	Nessus	SuSE Local Security Checks	high
49934	SuSE 10 Security Update : Xorg (ZYPP Patch Number 7126)	Nessus	SuSE Local Security Checks	high
49933	SuSE 10 Security Update : xorg-x11 (ZYPP Patch Number 7002)	Nessus	SuSE Local Security Checks	high
49757	SuSE9 Security Update : XFree86-server (YOU Patch Number 12638)	Nessus	SuSE Local Security Checks	high
49139	openSUSE Security Update : xorg-x11-Xvnc (openSUSE-SU-2010:0583-1)	Nessus	SuSE Local Security Checks	high
47688	SuSE9 Security Update : XFree86 (YOU Patch Number 12612)	Nessus	SuSE Local Security Checks	high
46758	CentOS 5 : xorg-x11-server (CESA-2010:0382)	Nessus	CentOS Local Security Checks	high
46672	Ubuntu 8.04 LTS / 9.04 / 9.10 : xorg-server vulnerabilities (USN-939-1)	Nessus	Ubuntu Local Security Checks	high
46303	RHEL 5 : xorg-x11-server (RHSA-2010:0382)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2010-1166

critical

Tenable Plugins

high

critical

high

high

high

high

high

high

high

high

high

high